What is a VASP in crypto?

A VASP, or virtual asset service provider, is a business that carries out certain crypto services for other people, such as running an exchange or holding coins in custody. The term comes from the Financial Action Task Force (FATF), the global body that sets anti-money laundering standards. Being a VASP matters because it brings duties such as checking customers' identities and sharing transfer information.

What is the FATF VASP definition?

FATF added virtual assets to its standards in October 2018 and updated Recommendation 15 in 2019 to extend anti-money laundering measures to VASPs. According to a Sidley Austin summary of FATF's 2019 guidance, a VASP is a person or company that, as a business and on behalf of others, does one or more of the following:

• Exchanges virtual assets for regular money.
• Exchanges one virtual asset for another.
• Transfers virtual assets.
• Keeps or administers virtual assets, or the keys that control them.
• Takes part in or provides financial services around a token issuer's offer or sale.

Under the standard, VASPs should run customer checks on occasional transactions above 1,000 dollars or euros and pass sender and recipient data with transfers, known as the travel rule. Identity checks are covered in what is KYC.

Who is not a VASP?

FATF's rules target intermediaries, not individuals. Dechert's summary of FATF's 2021 updated guidance says person-to-person transfers between self-hosted wallets fall outside the standard, and that software on its own is not a VASP. Firms that only provide supporting infrastructure, such as cloud storage, are also excluded.

DeFi is a grey area. The guidance says creators, owners and operators who keep control or enough influence over a DeFi arrangement may count as VASPs, even when the setup looks decentralized.

What is a VASP license?

FATF does not issue licences. It says VASPs should be licensed or registered where they are created, and countries may also require it from firms serving their residents. Each country then writes its own regime.

Dubai's Virtual Assets Regulatory Authority is one example. Its FAQ lists licensed activities including exchange, custody, broker-dealer, lending and borrowing, and transfer and settlement services, and says no virtual asset activity is exempt from supervision. The US approach, which uses different terms, is described in crypto anti-money laundering rules.

What is the difference between a CASP and a VASP?

CASP means crypto-asset service provider, the term used in the EU's MiCA regulation. It covers much the same kinds of businesses, but MiCA is a single EU-wide authorization regime rather than a global standard that each country adapts. The wider law is explained in what is MiCA.

ESMA, the EU securities regulator, said the MiCA transitional period ended on July 1, 2026. It expects unauthorized providers to stop taking new EU clients and wind down, and tells customers to check the ESMA register to see whether their provider is authorized. Clients of unauthorized firms, it warns, do not get MiCA's safeguards, including protections for their assets.

Rules differ by country and change often. Check the regulator or a qualified professional for your own situation.